CVE-2025-4367 | Medium | 6.4 | 2025-06-19 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, an… |
CVE-2024-8284 | Medium | 4.8 | 2025-05-15 | The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors t… |
CVE-2024-13126 | Medium | 4.6 | 2025-03-16 | The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of f… |
CVE-2025-1785 | Medium | 5.4 | 2025-03-13 | The Download Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.08 via the 'wpdm_newfile' action. This… |
CVE-2024-56217 | Medium | 4.3 | 2024-12-31 | Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2024-10706 | Medium | 4.8 | 2024-12-20 | The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-11768 | Medium | 5.3 | 2024-12-19 | The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the check… |
CVE-2024-11740 | High | 7.3 | 2024-12-19 | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the s… |
CVE-2024-8444 | Medium | 5.4 | 2024-10-30 | The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting. |
CVE-2024-6208 | Medium | 6.4 | 2024-07-31 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, an… |
CVE-2024-2098 | High | 7.5 | 2024-06-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to an improper authorization check on the 'protectMediaLibrary' func… |
CVE-2024-1766 | Medium | 4.4 | 2024-06-12 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 d… |
CVE-2024-5266 | Medium | 6.4 | 2024-06-12 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_re… |
CVE-2024-4160 | Medium | 6.4 | 2024-05-31 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, an… |
CVE-2024-32131 | Medium | 5.3 | 2024-05-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Downlo… |
CVE-2024-29114 | Medium | 6.5 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden, Inc. Download Manager allows Stored XSS.This iss… |
CVE-2023-6954 | Medium | 6.4 | 2024-03-13 | The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2023-6785 | Medium | 5.3 | 2024-03-13 | The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.8… |
CVE-2023-6421 | High | 7.5 | 2024-01-01 | The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one. |
CVE-2023-2305 | Medium | 6.4 | 2023-06-09 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in… |
CVE-2023-1524 | Medium | 6.5 | 2023-05-30 | The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is gener… |
CVE-2023-1809 | High | 7.5 | 2023-05-02 | The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary passw… |
CVE-2022-45836 | Medium | 6.3 | 2023-04-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions. |
CVE-2022-4476 | Medium | 5.4 | 2023-01-16 | The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whi… |
CVE-2022-2436 | High | 8.8 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and incl… |
CVE-2022-2431 | High | 8.1 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file ty… |
CVE-2022-36288 | Medium | 5.4 | 2022-08-23 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-34658 | Medium | 5.4 | 2022-08-23 | Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-34347 | Medium | 4.2 | 2022-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress. |
CVE-2022-2362 | High | 7.5 | 2022-08-22 | The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possibl… |
CVE-2022-2101 | Medium | 6.4 | 2022-07-18 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2… |
CVE-2022-2168 | Medium | 6.1 | 2022-07-17 | The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading… |
CVE-2017-20093 | Medium | 4.3 | 2022-06-24 | A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. Affected is an unknown function. The manipulation leads to c… |
CVE-2022-1985 | Medium | 6.1 | 2022-06-13 | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient… |
CVE-2021-36896 | Medium | 4.8 | 2022-04-11 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2 |
CVE-2022-0828 | High | 7.5 | 2022-04-11 | The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force… |
CVE-2021-25087 | High | 7.5 | 2022-03-07 | The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attacker… |
CVE-2021-25069 | High | 8.8 | 2022-02-21 | The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL… |
CVE-2021-24969 | Medium | 5.4 | 2021-12-27 | The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin d… |
CVE-2021-24773 | Medium | 4.8 | 2021-11-01 | The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users… |
CVE-2021-34639 | High | 7.5 | 2021-08-05 | Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.p… |
CVE-2021-34638 | Medium | 6.5 | 2021-08-05 | Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file info… |
CVE-2019-15889 | Medium | 6.1 | 2019-09-03 | The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] para… |
CVE-2017-18497 | Medium | 6.1 | 2019-08-13 | The liveforms plugin before 3.4.0 for WordPress has XSS. |
CVE-2015-9301 | Critical | 9.8 | 2019-08-13 | The liveforms plugin before 3.2.0 for WordPress has SQL injection. |
CVE-2017-18032 | Medium | 6.1 | 2018-01-16 | The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php. |
CVE-2014-9260 | High | 8.8 | 2017-08-07 | The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option. |
CVE-2017-2217 | Medium | 6.1 | 2017-07-07 | Open redirect vulnerability in WordPress Download Manager prior to version 2.9.51 allows remote attackers to redirect users to arbitrary web sites and conduct… |
CVE-2017-2216 | Medium | 6.1 | 2017-07-07 | Cross-site scripting vulnerability in WordPress Download Manager prior to version 2.9.50 allows remote attackers to inject arbitrary web script or HTML via uns… |
CVE-2014-8585 | | | 2014-11-04 | Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in… |
CVE-2013-7319 | | | 2014-02-06 | Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HT… |